Add credential placeholders and env-backed secrets

[ProtonsAndElectrons]

Summary

• add environment-backed credential loading through CredentialsConfig and YAML env: entries
• resolve {{SECRET_ID}} placeholders at tool execution time while preserving original tool args in stream events
• document credential placeholder/env usage and add regression coverage for no-leak behavior

Closes #127

Tests

• set PYTHONUTF8=1&& set PYTHONIOENCODING=utf-8&& .venv\Scripts\python.exe -m unittest discover -s tests
• .venv\Scripts\python.exe -m ruff check mobilerun\credential_manager mobilerun\agent\tool_registry.py mobilerun\agent\utils\actions.py mobilerun\config_manager\config_manager.py tests\test_credentials.py tests\test_type_action.py

[ProtonsAndElectrons]

Rebased this branch on the current main and resolved the conflict with the new macro recording changes.

The resolution keeps credential placeholders resolved only at execution time, while macro recording stores the original placeholder text so resolved secret values are not serialized into recorded actions. I added a regression test for that path.

Validated locally:

• .venv\Scripts\python.exe -m pytest tests/test_macro_recording_actions.py tests/test_type_action.py tests/test_credentials.py -q -> 18 passed
• .venv\Scripts\python.exe -m ruff check mobilerun/credential_manager mobilerun/agent/tool_registry.py mobilerun/agent/utils/actions.py mobilerun/config_manager/config_manager.py tests/test_credentials.py tests/test_type_action.py tests/test_macro_recording_actions.py -> passed
• git diff --check -> passed